CVE-2026-89622

CVE-2026-89622 is a write use-after-free in the Linux kernel's HID mcp2221 driver . The function mcp_i2c_smbus_read() stores a caller-supplied buffer pointer in mcp->rxbuf but fails to clear it when an I2C/SMBus transfer completes or times out. Once the caller frees the buffer, a delayed or sp...

CVE-2026-89622 HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

CVE-2026-89622

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

CVE-2026-89623 HID: mcp2221: stop device IO before hid_hw_stop

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister so that incoming HID reports cannot race with hardware teardown during probe failure or device removal...

CVE-2026-89623

CVE-2026-89623 affects the Linux kernel's HID mcp2221 driver . During probe failure or device removal, incoming HID reports could race with hardware teardown in the mcp2221_hid_unregister() devm cleanup callback, resulting in a potential use-after-free . The fix quiesces device I/O by calling hid...

CVE-2026-89623

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister so that incoming HID reports cannot race with hardware teardown during probe failure or device removal...

CVE-2026-89623 HID: mcp2221: stop device IO before hid_hw_stop

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister so that incoming HID reports cannot race with hardware teardown during probe failure or device removal...

EUVD-2026-76535

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister so that incoming HID reports cannot race with hardware teardown during probe failure or device removal...

CVE-2026-89621

CVE-2026-89621 is a Linux kernel vulnerability in the HID mcp2221 driver's mcp2221_raw_event() function. The function fails to validate the size of incoming HID reports in the MCP2221_I2C_GET_DATA path, trusting a device-supplied data[3] field as the copy length without verifying that 4 + data[3]...

CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89621

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

EUVD-2026-76533

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

EUVD-2026-76532

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-89619 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

CVE-2026-89620 HID: intel-thc-hid: intel-quickspi: validate report size before copy

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-89620

CVE-2026-89620 affects the Linux kernel HID Intel QuickSPI driver (intel-thc-hid: intel-quickspi). The function write_cmd_to_txdma() copies a caller-supplied report into a heap buffer (report_buf) sized to the device-descriptor-derived max_report_len (a few hundred bytes) without validating that ...

CVE-2026-89619

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

CVE-2026-89619 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

EUVD-2026-76531

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...